CN102510333B - Authorization method and system - Google Patents

Abstract

The invention discloses an authorization authentication method and system. The method includes: setting an external authentication key of the signature Key in the signature Key and the authorization Key, and the external authentication key is in one-to-one correspondence with the serial number of the signature Key; The key is sent to the signature Key by the first computer for storage; after receiving the identity authentication request, the second computer obtains the second random number and serial number from the signature Key and sends it to the authorization key; the authorization key uses the serial number to find the external authentication key, And use it and the encryption private key to sign the second random number to generate the data to be verified and send it to the signature Key through the second computer; the signature Key uses the encryption public key and the external authentication key to verify the received data to be verified. This method realizes the one-to-one or one-to-many association between the authorization key and the signature key. The signature key can only sign the data of each transaction after the authorization key passes its identity authentication, so as to ensure the authenticity of the bank-enterprise transaction. legality.

Description

A kind of authorized authentication method and system

technical field

The invention relates to the field of information security, in particular to an authorization authentication method and system realized by a signature Key and an authorization Key.

Background technique

At present, with the rapid development of computer technology, online banking (referred to as online banking) is becoming more and more popular, and more and more people are beginning to use this convenient and fast online banking service, such as personal online banking, corporate online banking, mobile banking, etc. These The applications of online banking interact with the background server of online banking through the Internet. Another mode of online banking is bank-enterprise direct connection. This mode realizes the secure link between the enterprise system (financial system/enterprise management system SAP/enterprise resource planning system ERP) and the banking system at the network level, which can effectively avoid Internet access. attack. However, for different enterprises, their internal management rules are not uniform. If they do not carry out safe and effective certification and management of enterprise front-end computers, it is easy to bring risks and losses to banks and enterprises.

In the prior art, the front-end computer of the enterprise is managed by a special person, and the USB Key is always inserted in the front-end computer. The USB Key needs to be authorized before it can be used. The value of the authorization process is the confirmation process of the PIN code. In the prior art, the PIN code is fixed. It is easy to leak, and because the USB Key is a portable device, it is easy to be transferred to other devices for use, posing a security risk; when conducting online transactions, the verification PIN code must be repeatedly entered for each transaction, and the operation is cumbersome; due to the PIN code cache At the software layer, every time a signature is signed, the software needs to interact with the hardware to authenticate the PIN code, and doing so will affect the overall response of the system.

Contents of the invention

The purpose of the present invention is to provide an authorization authentication method and system in order to solve the problems that the USB Key is easy to be transferred and the signature needs to repeatedly verify the PIN code.

An authorization authentication method provided by the present invention includes an association process and an authentication process, wherein the association process includes:

Step a: after the first computer receives the association request, set the external authentication key of the signature key in the signature key and the authorization key, and the external authentication key is in one-to-one correspondence with the serial number of the signature key;

Step b: the first computer derives the encryption public key from the authorization key and sends it to the signature key;

Step c: the signature Key saves the encrypted public key;

The certification process includes:

Step d: After receiving the identity authentication request, the second computer obtains the second random number and the serial number from the signature Key, and sends them to the authorization Key;

Step e: The authorization key searches for the corresponding external authentication key according to the received serial number, and uses the external authentication key and the encrypted private key corresponding to the encrypted public key to pair the received second Random numbers are signed to generate data to be verified, and the data to be verified is sent to the signature Key through the second computer;

Step f: The signature Key uses the encrypted public key and the external authentication key to verify the received data to be verified.

Wherein, after the first computer receives the association request in step a, it also includes:

The first computer judges whether there is an authorization key connected to it, and if yes, sets the external authentication key of the signature key in the signature key and the authorization key, otherwise, ends.

Wherein, the first computer sets the external authentication key of the signature key in the signature key and the authorization key, specifically:

The first computer obtains the external authentication key from the signature key, and sends it to the authorization key, and the authorization key receives and stores the external authentication key.

Wherein, the first computer sets the external authentication key of the signature key in the signature key and the authorization key, specifically:

The first computer obtains the serial number from the signature Key;

The first computer sets the external authentication key of the signature key, and if the setting is successful, sends the obtained serial number and the external authentication key to the authorization key, otherwise ends;

The authorization Key receives and saves the serial number and the external authentication key.

Wherein, the first computer sets the external authentication key of the signature Key, specifically:

The first computer obtains the external authentication key from the signature key.

Wherein, the first computer sets the external authentication key of the signature Key, specifically:

The first computer obtains an external authentication key from the authorization key;

The first computer sends the external authentication key to the signature key, and the signature key receives the external authentication key and saves it;

The external authentication key is randomly generated or preset by the authorization key.

Wherein, the first computer sets the external authentication key of the signature Key, specifically:

The first computer generates a random string of predetermined length, and sets it as the external authentication key of the signature Key;

The first computer sends the external authentication key to the signature key, and the signature key receives the external authentication key for storage.

Wherein, the first computer sets the external authentication key of the signature Key, specifically:

The first computer obtains respectively generated random strings from the signature Key and the authorization Key, and splices or merges the two to generate the external authentication key;

The first computer sends the external authentication key to the signature key, and the signature key receives the external authentication key for storage.

Wherein, before step b, it further includes: the authorization key generates the encryption private key and the encryption public key using an encryption algorithm.

Wherein, after the second computer receives the identity authentication request in the step d, it also includes:

The second computer judges whether there is an authorization key connected to it, if yes, the second computer obtains the second random number and the serial number from the signature key, and sends them to the authorization key, otherwise, ends.

Wherein, after the second computer receives the identity authentication request, it also includes:

The second computer verifies the PIN code of the authorization key, and if the verification passes, then sends the second random number and the serial number to the authorization key, and ends if the verification fails.

Wherein, the second computer verifies the PIN code of the authorization key, specifically:

The second computer obtains a first random number from the authorization key, encrypts the first random number using the received PIN code of the authorization key input by the user to generate first encrypted data, and sends the first encrypted data to Give the authorization key;

The authorized Key receives the first encrypted data, uses the stored PIN code to encrypt the first random number to generate second encrypted data, and judges whether it is the same as the first encrypted data, and if so, sends the encrypted data to the second computer Return the verification pass information, if not, end.

Wherein, the authorized Key in the step e uses the external authentication key and the encrypted private key to sign the received second random number to generate the data to be verified, specifically:

The authorization key uses the external authentication key to calculate the second random number to obtain a first calculation result, and uses the encrypted private key to sign the first calculation result to generate data to be verified.

Wherein, the authorization key uses the external authentication key to perform an encryption algorithm on the second random number to obtain the first calculation result.

Wherein, the step f is specifically: the signature Key uses the encrypted public key to decrypt the received data to be verified, and if the decryption is successful, uses the external authentication key to decrypt the second random number Calculating to generate a second calculation result, judging whether the second calculation result is consistent with the successful decryption result, if yes, the verification is passed, otherwise, end; if the decryption fails, then end.

Wherein, the authorization Key sends the data to be verified and the first calculation result to the signature Key through the second computer.

Wherein, the step f is specifically: the signature Key uses the encrypted public key to decrypt the received data to be verified, and if the decryption is successful, uses the external authentication key to decrypt the second random number Calculating to generate a second calculation result, judging whether the second calculation result is consistent with the received first calculation result, if yes, then the verification is passed, otherwise, end; if the decryption fails, then end.

Wherein, the step f specifically includes: the signature Key uses the encryption public key to decrypt the received data to be verified, if the decryption is successful, a first decryption result is obtained, and the external authentication key is used to decrypt the data to be verified. The first decryption result is decrypted, if the decryption is successful, the second decryption result is obtained, and it is judged whether the second decryption result is consistent with the second random number, if it is consistent, the verification is passed, otherwise it ends; if the decryption fails, it ends; If the decryption fails, it ends.

Wherein, if the verification is passed, the signature Key returns a verification passing prompt message to the second computer.

Wherein, after the verification is passed, it further includes: synchronously updating the external authentication key with the authorization key and the signature key.

Wherein, the authorization Key and the signature Key update the external authentication key synchronously, specifically:

The second computer obtains a third random number and the serial number of the signature key from the signature key and sends it to the authorization key;

The authorization key finds the external authentication key according to the received serial number, uses the encrypted private key to encrypt the received third random number, and sends the encrypted result to the second computer through the second computer. The above signature Key;

The signature Key uses the encryption public key to decrypt the received encryption result, and if the decryption is successful, replace the external authentication key with the third random number, and give The authorization Key returns the verification passing information, and ends if the decryption fails;

The authorization key updates the stored external authentication key to the third random number after receiving the verification passing information.

The present invention also provides an authorization authentication system, including: an authorization Key, a computer, and a signature Key;

The authorization key includes:

The first receiving module is used to receive the serial number and the second random number of the signature Key sent by the computer during authentication;

The first storage module: used to store the encryption public key and the encryption private key, receive and store the external authentication key sent by the computer;

A search module, configured to search for a corresponding external authentication key in the first storage module according to the received serial number of the signature Key during authentication;

A signature module, configured to use the found external authentication key and the encrypted private key to sign the received second random number to generate data to be verified;

a first sending module, configured to send the encryption public key and the data to be verified to the computer;

The first interface module is used to establish a connection with the computer;

The computers include:

The second receiving module is configured to receive an association request and an identity authentication request initiated by a user, and receive the encrypted public key and data to be verified sent by the first sending module;

A setting module, configured to set the external authentication key of the signature key in the signature key and the authorization key when the association request is received;

An acquisition module, configured to acquire a second random number and a serial number of the signature Key from the signature Key when an identity authentication request is received;

The second sending module is configured to send the received encryption public key to the signature Key during association; to send the acquired serial number and the second random number of the signature Key to the authorization Key during authentication, and The received data to be verified is sent to the signature Key;

The second interface module is used to establish a connection with the authorization Key and the signature Key;

The signature Key includes:

A third receiving module, configured to receive the encrypted public key and the data to be verified sent by the second sending module;

A second storage module, configured to store the external authentication key, the serial number of the signature Key, the second random number and the received encrypted public key;

a verification module, configured to use the stored encrypted public key and external authentication key to verify the received data to be verified;

The third interface module is used to establish a connection with the computer.

Wherein, the setting module includes: a generating unit for generating an external authentication key; a sending unit for sending the external authentication key to the authorization key and signature key.

Wherein, the authorization key also includes a first generation module, and the signature key also includes a second generation module, the first generation module is used to generate a first random string, and the second generation module is used to generate a second random string string; the setting module also includes an acquisition unit; the acquisition unit is used to obtain the first random string and the second random string from the first generation module and the second generation module respectively; the generation unit is specifically used The external authentication key is generated by splicing or merging the acquired first random string and second random string.

Wherein, the setting module includes: an obtaining unit, configured to obtain the external authentication key from the second storage module when an association request is received; a sending unit, configured to transfer the obtained external authentication key The key is sent to the first storage module.

Wherein, the setting module includes: an obtaining unit, configured to obtain the external authentication key from the first storage module when an association request is received; a sending unit, configured to transfer the obtained external authentication key The key is sent to the second storage module.

Wherein, the obtaining unit of the setting module is also used to obtain the serial number of the signature Key from the second storage module when receiving the association request; the sending unit is also used to transfer the obtained signature Key The serial number of the signature key is sent to the first storage module; the first storage module is also used to store the serial number of the signature key.

Wherein, the authorization key further includes a first generating module, configured to generate the encrypted public key and encrypted private key according to a public key encryption algorithm.

Wherein, the first generation module is also used to generate a first random number.

Wherein, the computer also includes a second encryption module; the second receiving module is also used to receive the PIN code of the authorization key input by the user; the acquisition module is also used to obtain the first random number from the authorization key; the second The encryption module is used to encrypt the obtained first random number by using the received PIN code of the authorization key input by the user to generate first encrypted data; the second sending module is also used to send the first random number An encrypted data is sent to the first receiving module; the authorization Key also includes a first encryption module and a first judgment module; the first receiving module is also used to receive the first encrypted data sent by the second sending module; The first storage module is also used to store the first random number and the PIN code of the authorization key; the first encryption module is used to encrypt and generate the stored first random number using the stored PIN code of the authorization key Second encrypted data; the first judging module is used to judge whether the second encrypted data is the same as the received first encrypted data.

Wherein, the computer further includes a second judging module for judging whether an authorized Key is connected to the computer.

Wherein, the signature module includes: a first calculation unit, configured to use the found external authentication key to calculate the stored second random number to generate a first calculation result; a signature unit, configured to use the The stored encrypted private key signs the first calculation result to generate data to be verified.

Wherein, the verification module includes: a decryption unit, configured to use the stored encrypted public key to decrypt the received data to be verified; a second calculation unit, configured to use the stored external authentication key pair The stored second random number is calculated to generate a second calculation result; the judging unit is configured to judge whether the decryption result obtained through successful decryption is the same as the second calculation result.

Wherein, the first calculation unit is specifically configured to use the found external authentication key to encrypt and calculate the stored second random number to generate a first calculation result.

Wherein, the first sending unit is also used to send the first calculation result; the second receiving module is also used to receive the first calculation result, and the second sending module is also used to send the received The first calculation result is sent to a third receiving module; the third receiving module is also configured to receive the first calculation result.

Wherein, the verification module includes: a decryption unit, configured to decrypt the received data to be verified by using the stored encrypted public key; Whether the first calculation result of is the same.

Wherein, the verification module includes: a first decryption unit, configured to use the stored encrypted public key to decrypt the received data to be verified; a second decryption unit, configured to use the stored external authentication key The key decrypts the result successfully decrypted by the first decryption unit; the judging unit is configured to judge whether the decrypted result successfully decrypted by the second decryption unit is the same as the stored second random number.

Wherein, the signature Key further includes a third sending module, configured to send verification passing prompt information to the computer when the verification is passed.

Wherein, the authorization Key also includes an update module, and the signature Key also includes a decryption module and a replacement module; the second receiving module is also used to receive the encryption result sent by the first sending module, and receive the encryption result sent by the third sending module. The verification success information; The acquisition module is also used to obtain the third random number and the serial number of the signature Key from the signature Key; The second sending module is also used to obtain the third random number and The serial number of the signature Key is sent to the first receiving module, and the received verification success information is sent to the update module, for sending the received encryption result to the third receiving module; The first receiving module is also used to receive the third random number and the serial number of the signature Key sent by the second sending module; the first storage module is also used to store the third random number; the search unit is also It is used to search the corresponding external authentication key in the first storage module according to the received serial number of the signature Key; the first encryption module is also used to search the corresponding external authentication key according to the encrypted private key in the first storage module Encrypting the received third random number; the update module is configured to update the external authentication key in the first storage module to the third random number after receiving the successful verification information; A sending module is also used to send the encryption result in the first encryption module to the second receiving module; the third receiving module is also used to receive the encryption result sent by the second sending module; the first The second storage module is also used to store a third random number; the decryption module is used to use the encryption public key in the second storage module to decrypt the received encryption result; the replacement module is used to When the decryption module successfully decrypts, replace the external authentication key in the second storage module with the third random number; the third sending module is also used to send the second random number to the second The receiving module sends verification success information.

Compared with the prior art, the present invention has the following advantages:

The present invention realizes the one-to-one or one-to-many association between the authorization Key and the signature Key. The signature Key obtains the signature authority through the authentication of the authorization Key. signature, thereby ensuring the authenticity and legitimacy of bank-enterprise transactions; as long as the signature Key is not pulled out or the certified computer is restarted in the method provided by the invention, the signature Key does not need to be authenticated again, which simplifies the cumbersome operation of multiple signature operations .

Description of drawings

FIG. 1 is a flowchart of an authorization authentication method provided by Embodiment 1 of the present invention;

FIG. 2 is a flow chart of an association process of another authorization authentication method provided in Embodiment 2 of the present invention;

FIG. 3 is a flowchart of an authentication process of another authorization authentication method provided in Embodiment 2 of the present invention;

FIG. 4 is a flow chart of simultaneously updating the external authentication key by the authorization Key and the signature Key in yet another authorization authentication method provided by Embodiment 2 of the present invention after the authentication process ends;

FIG. 5 is a block diagram of an authorization authentication system provided by Embodiment 3 of the present invention;

FIG. 6 is a block diagram of another authorization authentication system provided by Embodiment 4 of the present invention.

Detailed ways

In order to further explain the technical means and effects of the present invention to achieve the purpose of booking, the following is combined with the accompanying drawings and preferred embodiments to describe an authorization authentication method and system according to the present invention, its specific implementation, features and Efficacy, as described below.

Embodiment one

This embodiment provides a kind of authorized authentication method, is carried out when signature Key is inserted on the computer, and signature Key carries out one-to-many association with signature Key, as shown in Figure 1, authorization Key and signature Key are established in this method The associated process includes S101-S107;

S101: The first computer receives the association request, and judges whether there is an authorization key connected to the first computer, if yes, execute S102, otherwise end;

S102: the first computer obtains the serial number from the signature Key;

Specifically, in this embodiment, the length of the serial number is 12 bits agreed in advance, and the serial number is used as the ID of the external authentication key;

S103: The first computer sets the external authentication key of the signature key, if the setting is successful, execute step 104, otherwise end;

Preferably, in this embodiment, S103 also includes

S103': The first computer performs identity verification on the signature key, if the verification is passed, continue, otherwise end;

Preferably, in this embodiment, the external authentication key of the signature key set by the first computer is specifically:

S103-1: the first computer generates a random string of predetermined length;

S103-2: The first computer sets the generated random string as the external authentication key of the signature Key, and sends it to the signature Key;

In addition, the above-mentioned random string can also be generated by the signature Key or the authorization Key. After the first computer obtains the random string from the signature Key or the authorization Key, it sets the obtained random string as the external authentication key of the signature Key;

The above-mentioned random strings can also be generated by the signature Key and the authorization Key respectively, and the first computer obtains the respective generated random substrings from the signature Key and the authorization Key, and performs transformations such as splicing and merging to generate an external authentication key;

The external authentication key can also be a random number generated by the authorization key or a preset value, and the first computer obtains the external authentication key from the authorization key;

S104: the first computer sends the obtained serial number and the set external authentication key to the authorization key;

S105: The authorized Key receives the serial number and the external authentication key and stores them, and the authorized Key is associated with the signature Key;

S106: Authorize the Key to send the encrypted public key to the first computer;

S107: The first computer receives the encrypted public key and forwards it to the signature Key;

Specifically, in this embodiment, the encryption public key corresponds to the encryption private key built into the authorization key, and the encryption private key is generated by the authorization key; in addition, the encryption private key can also be imported into the authorization key in advance. in Key;

S108: The signature Key receives the encrypted public key and saves it;

In this embodiment, if the authorization key is only associated with one signature key, the serial number of the signature key may not be obtained.

In the method provided in this embodiment, the process of using the authorization key to authenticate the signature key is as follows:

S109: After receiving the identity authentication request, the second computer judges whether there is an authorized Key connected to the second computer, if yes, execute S110, otherwise end;

S110: the second computer obtains the serial number from the signature Key;

In this embodiment, if the authorization key is only associated with one signature key, S110 may not be performed;

S111: the second computer issues a "generate random number" command to the signature Key;

S112: After the signature Key receives the "generate random number" command, generate a random string of predetermined length and save it;

S113: The signature Key sends the generated random string to the second computer;

S114: the second computer sends the obtained serial number and the received random string to the authorization key;

S115: Authorize Key to receive the serial number and random string, and search for the corresponding external authentication key according to the serial number, if found, execute S116, if not found, end;

S115 can also be replaced by S115',

S115': The authorized Key receives the serial number and random string, and searches for the corresponding external authentication key according to the serial number. If found, the authorized Key checks whether a dedicated private key is stored. If yes, execute S116, otherwise end, if not found, then Finish;

S116: The authorized key encrypts the received random string with the found external authentication key, and signs the encrypted result with the stored encrypted private key;

In this embodiment, the algorithm used for encryption is pre-agreed; preferably, in this embodiment, the algorithm is 3DES; in addition, it can also be other symmetric encryption algorithms such as DES and AES;

S117: Authorize the Key to concatenate the encryption result and the signature result according to a predetermined format and then send it to the second computer;

S118: The second computer receives the spliced encryption result and signature result and forwards them to the signature Key;

S119: Signature Key receives the spliced encryption result and signature result, and uses the stored encrypted public key to verify the signature result, if the verification is successful, execute step S120, and if the verification fails, end;

S119 can also be replaced by S119',

S119': Signature Key receives the spliced encryption result and signature result, checks whether the encryption public key is stored, and if it exists, uses the stored encryption public key to verify the signature result; if the verification is successful, execute step S120, and if the verification fails, end; end if not present;

S120: The signature key uses the encryption result to authenticate the signature key;

In this embodiment, the specific process of authenticating the signature Key is as follows:

The signature key uses the built-in external authentication key to decrypt the encrypted result. If the decryption is successful, it is judged whether the decrypted result is consistent with the currently saved random string. If yes, the identity authentication is passed;

In addition, it can also be:

The signature key uses the built-in external authentication key to encrypt the currently stored random string to generate a second encryption result, and judges whether the second encryption result is consistent with the received encryption result. If yes, the identity authentication is passed; otherwise, it ends.

After the identity authentication is passed, the method provided by this embodiment further includes: clearing the currently stored random string of the signature Key.

In this embodiment, the authorization key and the signature key can also update the external authentication key synchronously. The specific update process is the same as the association process, and the identity authentication process of the signature key is the same as the above authentication process, which will not be repeated here.

Embodiment two

An authorization authentication method provided by Embodiment 2 of the present invention includes an association process and an authentication process. The specific implementation technical solution is: the authorization key and the signature key are transmitted through the computer, and after the PIN verification of the authorization key is passed, the authorization key and the signature key Perform one-to-many association. After association, when using the signature key to operate, the signature key needs to be authenticated by the authorization key in advance. After the authentication is passed, the signature key can be used for operation.

The first computer in this embodiment includes a terminal and associated programs installed inside it. Referring to Figure 2, the association process specifically includes:

S201: The first computer receives the association request, and judges whether there is an authorization key and a signature key connected to the first computer, if yes, execute S202, otherwise end;

S202: the first computer obtains the external authentication key and serial number from the signature Key;

In this embodiment, the external authentication key is a symmetric key, which is a random number or a preset value randomly generated by the signature Key. Preferably, the external authentication key is a random number randomly generated by the signature Key;

Specifically, the external authentication key in this embodiment is 8 bits, and the serial number is 12 bits, and the serial number is used as the ID of the external authentication key;

S203: the first computer sends the serial number and the external authentication key to the authorization key;

S204: The authorization Key receives the serial number and the external authentication key and saves them;

S205: Authorize the Key to export the encrypted public key and send it to the first computer;

Specifically, in this embodiment, the encryption public key of the authorization key, the encryption private key and the serial number of the signature key are in one-to-one correspondence;

In this embodiment, the encrypted public key is generated or pre-stored by the RSA encryption algorithm. Preferably, the encrypted public key in this embodiment is obtained by the RSA encryption algorithm, and the encrypted private key is stored in the authorized Key and is not exported;

S206: The first computer receives the encrypted public key and forwards it to the signature Key;

S207: The signature Key receives the encrypted public key and saves it;

During identity authentication, the external authentication key is used as the PIN code of the signature key.

In this embodiment, the second computer (i.e., the front-end processor) includes a terminal and a software program on the terminal. The authentication process in the method provided by this embodiment is shown in Figure 3, specifically including:

S301: The second computer receives the identity authentication request, and judges whether there is an authorization key and a signature key connected to the second computer, if yes, execute step S302, otherwise end;

S302: The second computer obtains the first random number from the authorization Key;

Specifically, in this embodiment, the first random number is randomly generated or pre-stored by the authorized Key. Specifically, in this embodiment, the first random number is randomly generated, and the first random number generated by the authorized Key pair make a backup;

S303: The second computer receives the PIN code of the authorization key input by the user, and uses it to encrypt the obtained first random number to generate first encrypted data;

Specifically, in this embodiment, the PIN code of the authorized Key is set to 8 digits;

S304: The second computer sends the first encrypted data to the authorization key;

S305: Authorize the Key to receive the first encrypted data, use the stored PIN code to encrypt the backup first random number, and generate the second encrypted data;

S306: Authorize the Key to judge whether the first encrypted data is the same as the second encrypted data, if they are the same, pass the verification of the authorized Key, execute S307, and end if not

S307: Authorize the Key to return verification passing information to the second computer;

S308: The second computer obtains the second random number and the serial number from the signature Key after receiving the verification information;

Specifically, the second random number in the signature Key is randomly generated or pre-stored. Preferably, in this embodiment, the second random number in the signature Key is randomly generated, and the second random number generated by the signature Key pair number for backup;

S309: the second computer sends the second random number and the serial number to the authorization key;

S310: Authorize the Key to receive the second random number and serial number, and search for the corresponding external authentication key according to the serial number, if found, execute S311, and if not found, end;

S311: The authorization key uses the found external authentication key to calculate the received second random number to obtain a first calculation result, and uses the stored encrypted private key to sign the first calculation result to generate data to be verified;

Preferably, in this embodiment, DES is used to calculate the received second random number; specifically, 3DES is used to encrypt the second random number to obtain the first calculation result of 8 bytes, and the first calculation As a result, sign after pkcs1 padding, and generate 128 bytes of data to be verified;

S312: Authorize the Key to send the first calculation result and the data to be verified to the second computer;

S313: The second computer receives the first calculation result and the data to be verified and forwards it to the signature Key;

S314: The signature Key receives the first calculation result and the data to be verified, uses the stored encrypted public key to verify the data to be verified, if the verification is passed, execute S315, and if the verification fails, then end;

S315: The signature Key uses the external authentication key to calculate the backup second random number to generate a second calculation result;

Specifically, the calculation rule in this step is consistent with the calculation rule in S311, which is preset in the signature Key and authorization Key;

S316: Signature Key judges whether the second calculation result is consistent with the received first calculation result, if yes, execute S317, otherwise end;

In this embodiment, S312-S316 can be replaced by S312'-S316';

S312': Authorize the Key to send the data to be verified to the second computer;

S313': the second computer receives the data to be verified and forwards it to the signature Key;

S314': Signature Key receives the data to be verified, uses the stored encrypted public key to verify the data to be verified, if the verification is passed, execute S315', and if the verification fails, it ends;

S315': The signature Key uses the external authentication key to calculate the backup second random number to generate a second calculation result;

The calculation rule in this step is consistent with the calculation rule in S311, and is preset in the signature Key and the authorization Key; preferably, an encryption algorithm is used; the order of S314' and S315' can be exchanged;

S316': Signature Key judges whether the second calculation result is consistent with the result obtained by passing the verification, if yes, execute S317, otherwise end;

In this embodiment, if an encryption algorithm is used in S211, then S315' and S316' can also be replaced by:

S315": The signature Key uses the external authentication key to decrypt the result obtained by passing the verification. If the decryption is successful, the second decryption result is obtained, and S316" is executed. If the decryption fails, it ends;

S316": The signature Key judges whether the second decryption result is consistent with the second random number backed up, and if they are consistent, execute S317, otherwise end.

S317: Return the signature Key to the second computer to indicate that the verification is passed.

In this embodiment, the signature key is associated with the authorization key, and the identity authentication of the signature key is performed using the authorization key before transaction signing, and the transaction information can be signed only after the authentication is passed, so as to improve the security of the transaction process.

In this embodiment, after the authorization Key authenticates the signature Key, the authorization Key and the signature Key can update the external authentication key at the same time, as shown in Figure 4, including:

S401: the second computer obtains the third random number and the serial number of the signature key from the signature key;

S402: the second computer sends the third random number and serial number to the authorization key;

S403: The authorized Key receives the third random number and the serial number, and finds the external authentication key according to the serial number;

S404: Authorize the Key to back up the third random number, and use the stored encrypted private key to encrypt the third random number;

S405: Authorize the Key to return the encryption result to the second computer;

S406: The second computer sends the encryption result to the signature key;

S407: The signature Key receives the encrypted result, and uses the stored encrypted public key to decrypt the encrypted result. If the decryption is successful, execute S408. If the decryption fails, end;

Specifically, in this embodiment, the public key stored in the signature key has a one-to-one correspondence with the authorized private key;

S408: The signature Key replaces the external authentication key with a third random number;

S409: return the signature Key to the second computer to pass the verification information;

S410: The second computer receives the verification information and forwards it to the authorization key;

S411: The authorization key updates the stored external authentication key to the backup third random number after receiving the verification passing information.

In this embodiment, after the signature key is authenticated by the authorized key, as long as the signature key is not removed or the second computer is not restarted, the signature key directly performs the signature operation when there is a signature request, which simplifies the verification process of the PIN code of the signature key; Even if the signature key is moved to another PC, it cannot be operated without the cooperation of the authorized key, which improves the security of the transaction signature operation.

Embodiment Three

Embodiment 3 of the present invention provides an authorization authentication system, as shown in FIG. 5 , including: authorization Key3, computer 2 and signature Key1;

Authorization Key1 specifically includes:

The first receiving module 11 is used to receive the serial number and the external authentication key of the signature Key sent by the computer during association, and receive the first encrypted data, the serial number and the second random number of the signature Key sent by the computer during authentication;

The first generating module 12 is used to generate an encrypted public key and an encrypted private key according to the RSA encryption algorithm (), and is also used to generate the first random number and/or random string;

The first storage module 13 is used to store the encrypted public key and encrypted private key, the serial number of the signature Key received during association, the external authentication key, and the second random number received during authentication; it is also used to store the first random number number and the PIN code of the authorized Key;

In this embodiment, the encryption public key, the encryption private key and/or the first random number are randomly generated by the first generation module 12, or preset; the serial number of the signature Key corresponds to the encryption public key and the encryption private key one by one ;The external authentication key is randomly generated or preset;

A search module 14, configured to search for a correspondingly stored external authentication key according to the serial number received during authentication;

The first encryption module 15 is used to encrypt the first random number stored using the PIN code of the stored authorization Key to generate the second encrypted data;

The first judging module 16 is used to judge whether the received first encrypted data is the same as the calculated second encrypted data;

Signature module 17, including:

The first calculation unit 171 is configured to use the found external authentication key to calculate the stored second random number to generate a first calculation result;

A signature unit 172, configured to use the stored encrypted private key to sign the calculated first calculation result to generate data to be verified;

The first sending module 18 is used to send the encryption public key, the data to be verified and the verification passing information generated when the first judging module 16 judges the same to the computer 2;

The first interface module 19 is used to establish a connection with the computer 2;

Computer 2 specifically includes:

The second receiving module 21 is used to receive the association request initiated by the user, the identity authentication request, the PIN code of the authorization key input by the user, receive the verification passing prompt information sent by the signature key, receive the encrypted public key sent by the first sending module 18, Verification passed information to be verified data;

The second judging module 22 is used to judge whether the authorized Key1 and the signature Key3 are connected with the computer 2;

The obtaining module 23 is used to obtain the second random number and the serial number of the signature Key from the signature Key when receiving the identity authentication request; it is also used to obtain the first random number from the authorization Key;

The second encryption module 24 is used to encrypt the first random number obtained by using the received PIN code input by the user to generate the first encrypted data;

A setting module 25, configured to set the external authentication key of the signature key in the signature key and the authorization key when the association request is received;

In this embodiment, the setting module 25 includes:

A generating unit 251, configured to generate an external authentication key;

A sending unit 252, configured to send the generated external authentication key to the first receiving module 11 and the signature Key;

The setting module 25 also includes an acquisition unit 253, which is used to obtain random strings from the first generation module 12 and the second generation module 32, and is also used to obtain the serial number of the signature Key from the second storage module 33;

The generating unit 251 is specifically configured to splice or combine the obtained random strings to generate an external authentication key;

Or, setting module 25 includes:

An obtaining unit, configured to obtain the external authentication key from the second storage module 33 or the first storage module 13 when the association request is received;

The sending unit is configured to send the obtained external authentication key to the first storage module 13 or the second storage module 33 .

The second sending module 26 is used to send the serial number and the external authentication key of the signature Key obtained to the first receiving module 11 during association, and send the encrypted public key received to the signature Key; Module 11 sends the first encrypted data, the obtained second random number and the serial number of the signature Key, and sends the data to be verified to the signature Key;

The second interface module 27 is used to establish a connection with the authorization Key1 and the signature Key3;

Signature Key3 specifically includes:

The third receiving module 31 is configured to receive the encrypted public key and the data to be verified sent by the second sending module 25;

The second generation module 32 is used to generate an external authentication key, a second random number, and also to generate a random string;

The second storage module 33 is used to store the received encrypted public key, the serial number of the signature Key3, the second random number generated, and the external authentication key;

Specifically, in this embodiment, the second random number and the external authentication key are randomly generated by the second generating module 32, or are preset;

The verification module 34 is configured to use the stored encrypted public key and external authentication key to verify the received data to be verified, specifically including:

Decryption unit 341, configured to use the stored encrypted public key to decrypt the received data to be verified;

The second calculation unit 342 is configured to use the stored external authentication key to calculate the stored second random number to generate a second calculation result;

Specifically, in this embodiment, the algorithm used by the second calculation unit 342 and the first calculation unit 171 are the same;

The judging unit 343 is configured to judge whether the decryption result successfully obtained by the decryption unit 341 is the same as the second calculation result.

The third sending module 35 is configured to send a verification passing prompt message to the second receiving module 21 when the judging unit 343 judges that they are the same;

The third interface module 36 is used to establish a connection with the computer 2 .

In this embodiment, the verification module 34 in the signature Key also has other implementations,

Mode 1: the first sending module 18 in the authorization key is used to send the first calculation result and the data to be verified to the computer 2; the third receiving module 31 in the signature key is used to receive the data to be verified and the first calculation result, The verification module 34 includes: a decryption unit, which is used to decrypt the received data to be verified by using the stored encryption public key; a judgment unit, which is used to judge whether the decryption result obtained by decryption is the same as the received first calculation result .

Mode 2: the verification module 34 in the signature Key includes a first decryption unit, a second decryption unit and a judging unit; the first decryption unit is used to decrypt the received data to be verified using the stored encryption public key; the second decryption unit It is used to decrypt the successful decryption result of the first decryption unit by using the stored external authentication key; the judging unit is used to judge whether the successful decryption result of the second decryption unit is the same as the stored second random number.

The system provided by this embodiment is realized by combining software and hardware. The hardware adopts the signature Key and authorization Key encapsulated by a high-performance smart card chip, and is responsible for storing the enterprise certificate. The software is set in the computer for the application software communicating with the hardware USBKey. The bank implements the association between the signature key and the authorization key. When signing on the enterprise side, the authorization key needs to be used to authenticate the identity of the signature key. The signature operation can only be performed after the verification is passed, which greatly improves the security of the signature operation.

Embodiment four

Referring to Fig. 6, Embodiment 4 of the present invention provides an authorization authentication system. In addition to realizing the authorization authentication function of the system in Embodiment 3, the system provided in this embodiment also has an external authentication key for authorization Key and signature Key. The function of simultaneous update, as shown in Figure 6, on the basis of Figure 5, the authorization Key also includes the update module 10, and the signature Key also includes the decryption module 37 and the replacement module 38;

The second receiving module 31 is also used to receive the encryption result sent by the first sending module 18, and receive the verification success information sent by the third sending module 35;

The obtaining module 23 is also used to obtain the third random number and the serial number of the signature Key from the signature Key;

The second sending module 26 is also used to send the obtained third random number and the sequence number of the signature Key to the first receiving module, and send the received verification success information to the update module 10, for sending the received encryption result To the third receiving module 31;

The first receiving module 11 is also used to receive the third random number sent by the second sending module 26, the serial number of the signature Key, and the verification success information;

The first storage module 13 is also used for storing the third random number;

The search unit 14 is also used to search the corresponding external authentication key in the first storage module 13 according to the serial number of the received signature Key;

The first encryption module 15 is also used for encrypting the third random number received according to the encryption private key in the first storage module 13;

The update module 10 is configured to replace the external authentication key in the first storage module 13 with a third random number after receiving the verification success information;

The first sending module 18 is also used to send the encryption result in the first encryption module 15 to the second receiving module 21;

The third receiving module 31 is also used for receiving the encryption result sent by the second sending module 26;

The second storage module 33 is also used to store the third random number;

The decryption module 37 is used to decrypt the received encryption result using the encryption public key in the second storage module 33;

The replacement module 38 is used to replace the external authentication key in the second storage module 33 with a third random number when the decryption module 37 successfully decrypts;

The third sending module 35 is also configured to send verification success information to the second receiving module 21 when the decryption module 37 succeeds in decrypting.

The authorization authentication system provided in this embodiment can simultaneously update the external authentication key stored in the authorization Key and the signature Key after the authorization Key has passed the authorization verification of the signature Key, so that the external authentication key used for each transaction signature is Different, further improving the security of the signature operation.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto, any changes or variations that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (37)

1. an authorization and authentication method, is characterized in that, comprises association process and verification process, and wherein association process comprises:

Step a: the first computer receives after associated request arranges the external authentication key of described signature Key in signature Key and mandate Key, and described external authentication key is corresponding one by one with the sequence number of described signature Key;

Step b: described signature Key derived encrypted public key send to by described the first computer from described mandate Key;

Step c: described signature Key preserves described encrypted public key;

Wherein verification process comprises:

Steps d: second computer receives after ID authentication request, described second computer has judged whether to authorize Key to be connected with it, be that described second computer obtains the second random number and described sequence number from described signature Key, and send it to described mandate Key, otherwise finish;

Step e: described mandate Key searches corresponding external authentication key according to the described sequence number receiving, use described external authentication key and the encryption key corresponding with described encrypted public key to sign and generate data to be verified described the second random number receiving, described data to be verified are sent to described signature Key by described second computer;

Step f: described signature Key uses described encrypted public key and described external authentication key to verify the data described to be verified that receive.

2. authorization and authentication method as claimed in claim 1, is characterized in that, in described step a, the first computer also comprises after receiving associated request:

Described the first computer has judged whether to authorize Key to be connected with it, is in signature Key and mandate Key, the external authentication key of described signature Key to be set, otherwise finishes.

3. authorization and authentication method as claimed in claim 1 or 2, is characterized in that, described the first computer arranges the external authentication key of described signature Key in signature Key and mandate Key, is specially:

Described the first computer obtains described external authentication key from described signature Key, and sends it to mandate Key, and described mandate Key receives described external authentication key and preserves.

4. authorization and authentication method as claimed in claim 1 or 2, is characterized in that, described the first computer arranges the external authentication key of described signature Key in signature Key and mandate Key, is specially:

Described the first computer obtains sequence number from described signature Key;

The external authentication key of Key of signing described in described the first computer installation, if arranged successfully, sends to the described sequence number obtaining and described external authentication key to authorize Key, otherwise finish;

Described mandate Key receives described sequence number and external authentication key and preserves.

5. authorization and authentication method as claimed in claim 4, is characterized in that, the external authentication key of the Key that signs described in described the first computer installation, is specially:

Described the first computer obtains described external authentication key from described signature Key.

6. authorization and authentication method as claimed in claim 4, is characterized in that, the external authentication key of the Key that signs described in described the first computer installation, is specially:

Described the first computer obtains external authentication key from described mandate Key;

Described external authentication key is sent to described signature Key by described the first computer, and described signature Key receives described external authentication key and preserves;

Described external authentication key is that described mandate Key generates at random or sets in advance.

7. authorization and authentication method as claimed in claim 4, is characterized in that, the external authentication key of the Key that signs described in described the first computer installation, is specially:

Described the first computer generates the random train of predetermined length, and is made as the external authentication key of described signature Key;

Described external authentication key is sent to described signature Key by described the first computer, and described signature Key receives described external authentication key and preserves.

8. authorization and authentication method as claimed in claim 4, is characterized in that, the external authentication key of the Key that signs described in described the first computer installation, is specially:

Described the first computer is from described signature Key and authorize Key to obtain respectively the random train of each self-generating, both is spliced or are merged the described external authentication key of generation;

Described external authentication key is sent to described signature Key by described the first computer, and described signature Key receives described external authentication key and preserves.

9. authorization and authentication method as claimed in claim 1, is characterized in that, before step b, also comprises: described mandate Key uses cryptographic algorithm to generate described encryption key and described encrypted public key.

10. authorization and authentication method as claimed in claim 1, is characterized in that, described second computer also comprises after receiving ID authentication request:

Described second computer verifies the PIN code of described mandate Key, as is verified, and described the second random number and described sequence number sent to described mandate Key, as verified not by finishing.

11. authorization and authentication methods as claimed in claim 10, is characterized in that, described second computer is verified the PIN code of described mandate Key, is specially:

Described second computer obtains the first random number from authorize Key, uses the PIN code of the mandate Key of the user's input receiving to be encrypted and to generate the first enciphered data described the first random number, and described the first enciphered data is sent to and authorizes Key;

Described mandate Key receives described the first enciphered data, use the PIN code of storage to be encrypted and to generate the second enciphered data described the first random number, and judge that whether it is identical with the first enciphered data, returns to the information of being verified to second computer as identical, as difference finishes.

12. authorization and authentication methods as claimed in claim 1, is characterized in that, authorize Key to use described external authentication key and described encryption key to sign and generate data to be verified described the second random number receiving described in described step e, are specially:

Described mandate Key uses described external authentication key to calculate the first result of calculation to described the second random number, uses described encryption key to sign and generate data to be verified described the first result of calculation.

13. authorization and authentication methods as claimed in claim 12, is characterized in that, described mandate Key uses described external authentication key to be encrypted algorithm to described the second random number and obtains the first result of calculation.

14. authorization and authentication methods as described in claim 12 or 13, is characterized in that, described step f is specially:

Described signature Key uses described encrypted public key to be decrypted the data described to be verified that receive, as successful decryption use as described in external authentication key to as described in the second random number calculate generate the second result of calculation, judge that whether described the second result of calculation is consistent with the successful result of deciphering, be to be verified, otherwise finish; As Decryption failures finishes.

15. authorization and authentication methods as claimed in claim 13, is characterized in that, described mandate Key sends to described signature Key by described data to be verified and the first result of calculation by described second computer.

16. authorization and authentication methods as claimed in claim 15, is characterized in that, described step f is specially:

Described signature Key uses described encrypted public key to be decrypted the data described to be verified that receive, as successful decryption use as described in external authentication key to as described in the second random number calculate generate the second result of calculation, judge that whether described the second result of calculation is consistent with described the first result of calculation receiving, be to be verified, otherwise finish; As Decryption failures finishes.

17. authorization and authentication methods as claimed in claim 13, is characterized in that, described step f is specially:

Described signature Key uses described encrypted public key to be decrypted the data described to be verified that receive, as successful decryption obtains the first decrypted result, use described external authentication key to be decrypted described the first decrypted result, as successful decryption obtains the second decrypted result, judge that whether described the second decrypted result is consistent with described the second random number, as being unanimously verified, otherwise finish; As Decryption failures finishes; As Decryption failures finishes.

18. authorization and authentication methods as claimed in claim 1, is characterized in that, as be verified, and described signature Key returns to described second computer and is verified information.

19. authorization and authentication methods as claimed in claim 18, is characterized in that, after being verified, also comprise:

Described mandate Key and the described external authentication key of the synchronous renewal of signature Key.

20. authorization and authentication methods as claimed in claim 19, is characterized in that, described mandate Key and the described external authentication key of the synchronous renewal of signature Key, be specially:

Described second computer obtains the sequence number of the 3rd random number and described signature Key and sends it to described mandate Key from described signature key;

Described mandate Key finds described external authentication key according to receiving described sequence number, uses described encryption key to be encrypted described the 3rd random number receiving, and encrypted result is sent to described signature Key by described second computer;

Described signature Key uses described encrypted public key to be decrypted the described encrypted result receiving, as successful decryption, described external authentication key is replaced with to described the 3rd random number, and return to the information of being verified to described mandate Key by described second computer, as Decryption failures finishes;

Described mandate Key is described the 3rd random number by the external authentication key updating of storage after being verified information described in receiving.

21. 1 kinds of authorization identifying systems, is characterized in that, comprising: authorize Key, computer and signature Key;

Described mandate Key comprises:

The first receiver module, for receiving sequence number and the second random number of the described signature Key that described computer sends in when certification;

The first memory module: for storage encryption PKI and encryption key, receive the external authentication key of described computer transmission and preserve;

Search module, for search corresponding external authentication key according to the sequence number of the described signature Key receiving in described the first memory module in the time authenticating;

Signature blocks, for being used the described external authentication key and the described encryption key that find to sign and generate data to be verified described the second random number receiving;

The first sending module, for sending to described computer by described encrypted public key and data to be verified;

First interface module, for connecting with computer;

Described computer comprises:

The second receiver module, for receiving the associated request of Client-initiated and ID authentication request, receives described encrypted public key and data to be verified that described the first sending module sends;

Module is set, for the described external authentication key of described signature Key is set at described signature Key and mandate Key in the time receiving described associated request;

The second judge module, authorizes Key to be connected with described computer for having judged whether;

Acquisition module, for obtaining the sequence number of the second random number and described signature Key in the time receiving ID authentication request from the signature Key of described connection;

The second sending module, for sending to described signature Key by the encrypted public key receiving when the association; In the time of certification, sequence number and the second random number of the described signature Key obtaining are sent to described mandate Key, the data described to be verified that receive are sent to described signature Key;

The second interface module, for connecting with described mandate Key and signature Key;

Described signature Key comprises:

The 3rd receiver module, the encrypted public key and the data to be verified that send for receiving described the second sending module;

The second memory module, for the described encrypted public key of storing the sequence number of described external authentication key, described signature Key, described the second random number and receiving;

Authentication module, verifies the data described to be verified that receive for the described encrypted public key and the external authentication key that use storage;

The 3rd interface module, for connecting with computer.

22. authorization identifying systems as claimed in claim 21, is characterized in that, the described module that arranges comprises:

Generation unit, for generating external authentication key;

Transmitting element, for sending to described external authentication key described mandate Key and signature Key.

23. authorization identifying systems as claimed in claim 22, is characterized in that, described mandate Key also comprises the first generation module, and described signature Key also comprises the second generation module,

Described the first generation module is used for generating the first random train, and described the second generation module is used for generating the second random train;

The described module that arranges also comprises acquiring unit;

Described acquiring unit is for obtaining respectively described the first random train and the second random train from described the first generation module and the second generation module;

Described generation unit is specifically for splicing or merge the described external authentication key of generation by described the first random train obtaining and the second random train.

24. authorization identifying systems as claimed in claim 21, is characterized in that, the described module that arranges comprises:

Acquiring unit, for obtaining described external authentication key from described the second memory module in the time receiving associated request;

Transmitting element, for sending to described the first memory module by the described described external authentication key getting.

25. authorization identifying systems as claimed in claim 21, is characterized in that, the described module that arranges comprises:

Acquiring unit, for obtaining described external authentication key from described the first memory module in the time receiving associated request;

Transmitting element, for sending to described the second memory module by the described described external authentication key getting.

26. authorization identifying systems as described in claim 23-25 any one, is characterized in that, the described acquiring unit that module is set also for obtaining the sequence number of described signature Key in the time receiving associated request from described the second memory module;

Transmitting element is also for sending to described the first memory module by the sequence number of the described described signature Key getting;

Described the first memory module is also for storing the sequence number of described signature Key.

27. authorization identifying systems as claimed in claim 21, is characterized in that, described mandate Key also comprises the first generation module, for generate described encrypted public key and encryption key according to public key encryption algorithm.

28. authorization identifying systems as claimed in claim 27, is characterized in that, described the first generation module is also for generating the first random number.

29. authorization identifying systems as claimed in claim 28, is characterized in that, described computer also comprises the second encrypting module;

The second receiver module is also for receiving the PIN code of mandate Key of user input;

Described acquisition module is also for obtaining the first random number from mandate Key;

Described the second encrypting module is encrypted described the first random number getting for the PIN code of the mandate Key of user's input of receiving described in using, generates the first enciphered data;

Described the second sending module is also for sending to described the first receiver module by described the first enciphered data;

Described mandate Key also comprises the first encrypting module and the first judge module;

The first enciphered data that described the first receiver module also sends for receiving the second sending module;

Described the first memory module is the PIN code for storing the first random number and authorizing Key also;

The PIN code that described the first encrypting module is used for the described mandate Key that uses storage is encrypted and generates the second enciphered data described first random number of storage;

Described the first judge module is for judging that whether described the second enciphered data is identical with described the first enciphered data receiving.

30. authorization identifying systems as claimed in claim 21, is characterized in that, described signature blocks comprises:

The first computing unit, for using the described external authentication key finding to calculate and generate the first result of calculation described second random number of storage;

Signature unit, signs and generates data to be verified described the first result of calculation for the encryption key that uses described storage.

31. authorization identifying systems as claimed in claim 30, is characterized in that, described authentication module comprises:

Decryption unit, is decrypted the data described to be verified that receive for the described encrypted public key that uses storage;

The second computing unit, calculates described second random number of storage for the described external authentication key that uses storage, generates the second result of calculation;

Whether judging unit is identical with described the second result of calculation for judging the decrypted result that successful decryption obtains.

32. authorization identifying systems as claimed in claim 30, is characterized in that, described the first computing unit generates the first result of calculation specifically for using the described external authentication key finding to be encrypted to calculate to described second random number of storage.

33. authorization identifying systems as described in claim 30 or 32, is characterized in that, described the first transmitting element is also for sending described the first result of calculation;

Described the second receiver module is also for receiving described the first result of calculation, and described the second sending module is also for sending to the 3rd receiver module by described the first result of calculation receiving;

Described the 3rd receiver module is also for receiving described the first result of calculation.

34. authorization identifying systems as claimed in claim 33, is characterized in that, described authentication module comprises:

Decryption unit, is decrypted the data described to be verified that receive for the described encrypted public key that uses storage;

Judging unit, for judge decrypted result that successful decryption obtains with described in the first result of calculation of receiving whether identical.

35. authorization identifying systems as claimed in claim 33, is characterized in that, described authentication module comprises:

The first decryption unit, is decrypted the data described to be verified that receive for the described encrypted public key that uses storage;

The second decryption unit, is decrypted for the result that uses the described external authentication key of storage to obtain the first decryption unit successful decryption;

Whether judging unit is identical with described second random number of storage for judging the decrypted result that described the second decryption unit successful decryption obtains.

36. authorization identifying systems as claimed in claim 29, is characterized in that, described signature Key also comprises the 3rd sending module, are verified information for sending in the time being verified described computer.

37. authorization identifying systems as claimed in claim 36, is characterized in that, described mandate Key also comprises update module, and described signature Key also comprises deciphering module and replacement module;

The encrypted result that described the second receiver module also sends for receiving described the first sending module, receives the information that is proved to be successful that the 3rd sending module sends;

Described acquisition module is also for obtaining the sequence number of the 3rd random number and signature Key from described signature Key;

Described the second sending module is also for sending to described the first receiver module by the sequence number of described the 3rd random number getting and signature Key, send to described update module by being proved to be successful information described in receiving, for the described encrypted result receiving being sent to described the 3rd receiver module;

Described the first receiver module is also for receiving the sequence number of described the second sending module described the 3rd random number sending and the Key that signs;

Described the first memory module is also for storing the 3rd random number;

The described unit of searching is also for searching corresponding external authentication key according to the sequence number of the described signature Key receiving in described the first memory module;

Described the first encrypting module is also for being encrypted described the 3rd random number receiving according to the encryption key of described the first memory module;

Described update module, for receiving after the information of being proved to be successful, is described the 3rd random number by the external authentication key updating in described the first memory module;

The first sending module is also for sending to the encrypted result of described the first encrypting module described the second receiver module;

The encrypted result that described the 3rd receiver module also sends for receiving described the second sending module;

Described the second memory module is also by storage the 3rd random number;

Described deciphering module is for using the described encrypted public key of described the second memory module to be decrypted the described encrypted result receiving;

Described replacement module for replacing with the external authentication key of described the second memory module described the 3rd random number in the time of described deciphering module successful decryption;

Described the 3rd sending module is also for sending to described the second receiver module the information that is proved to be successful when the described deciphering module successful decryption.